Extracted

• • Target
    407d8c507994acf4e1a9afd2fd960cc8d089ef623018f8c09469f46c26d82dc9
  • Size 45KB
  • SHA256 407d8c507994acf4e1a9afd2fd960cc8d089ef623018f8c09469f46c26d82dc9
  • MD5 b3bdb862ab8c8057635208d4e2654f64
  • SHA1 5d53811c52a8883277a6d25a5434421b60e0e408
  • SHA512 fd69c9400df7f1ac567cf9cf33615d27731bd2ecd03747ce71d6fe8c2e859134d6171bb951adc76220388e5bcbc4baa570826a04cd16960c55a7e67cfc7c5393
  • SSDEEP 768:EufspTfzcR6uWUcb+wmo2q98wDHy/aKPIsPjbcgX3irfKJM11jZYSBDZsx:EufspTf2g238hs7bzXS+ivZYsdsx
  • TLSH
    T17423290037E8C12BF2BE5B78ADF26145867AF6632A03D64D1CC451DB5613FC68A426FE
  • MD5 SHA1 SHA512 SSDEEP TLSH

  Score

  10^/10

  defaultcommand_and_controldefense_evasiondiscoveryexecutionasyncratpersistencerat

  • Async RAT payload

    rat

  • Family: AsyncRat

    AsyncRAT is designed to remotely monitor and control other computers written in C#.

    ratasyncrat

  • Checks computer location settings

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE

  • Outbound SSH connection to public host

    SSH is used for remote access. This may indicate SSH host discovery, encrypted C2 traffic, or data exfiltration.

    command_and_control
  behavioral1behavioral2